Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:20295
HistoryAug 04, 2008 - 12:00 a.m.

Server termination in America's Army 2.8.3.1

2008-08-0400:00:00
vulners.com
5

#######################################################################

                         Luigi Auriemma

Applications: America's Army
http://www.americasarmy.com
Versions: <= 2.8.3.1
Platforms: Windows (tested), Linux and Mac
Bug: server termination due to failed assertion
Exploitation: remote, versus server
Date: 02 Aug 2008
Author: Luigi Auriemma
e-mail: [email protected]
web: aluigi.org

#######################################################################

1) Introduction
2) Bug
3) The Code
4) Fix

#######################################################################

===============
1) Introduction

From Wikipedia:
"America's Army (also known as AA or Army Game Project) is a tactical
multiplayer first-person shooter owned by the United States Government
and released as a global public relations initiative to help with U.S.
Army recruitment."

#######################################################################

======
2) Bug

The AA server can be terminated remotely through a specific single
spoofable UDP packet which leads to a failed assertion:

"Assertion failed: VoiceIndex<VOICE_MAX_CHATTERS"

Note: this bug is the same I found and disclosed in Unreal Tournament
2004 some days ago and which affects some other games too (ut2004null).

#######################################################################

===========
3) The Code

http://aluigi.org/poc/armynchia.zip

#######################################################################

======
4) Fix

No fix

#######################################################################


Luigi Auriemma
http://aluigi.org
http://backup.aluigi.org
http://mirror.aluigi.org